The California Consumer Privacy Act (CCPA) is one of the most significant privacy laws in the United States, giving California residents unprecedented control over their personal data. But how does CCPA intersect with face search technology? When you use a face search engine, you are querying databases that may contain facial data — and under CCPA, facial data can qualify as biometric information subject to privacy protections. This guide explains what CCPA means for face search users, how facesearching complies with California law, and what rights you have when your face appears in search results.
What Is the CCPA?
The CCPA, which took effect in 2020 and was expanded by the California Privacy Rights Act (CPRA) in 2023, gives California residents four core rights: the right to know what personal data is collected, the right to delete that data, the right to opt out of its sale, and the right to non-discrimination for exercising these rights. The law applies to businesses that collect personal information from California residents and meet certain thresholds — annual revenue over $25 million, data on 100,000 or more consumers, or deriving 50% or more of revenue from selling personal data.
CCPA and Biometric Data
Under the CCPA, biometric data — including facial geometry, fingerprints, and voiceprints — is considered sensitive personal information. The law defines biometric data as physiological, biological, or behavioral characteristics that can identify an individual. Facial recognition data, including the facial feature vectors used by reverse face search engines, falls squarely within this category. Businesses that process biometric data must disclose this processing, limit its use, and give consumers the right to opt out of its sale or sharing.
How CCPA Applies to Face Search Engines
A face search engine processes facial data in two ways. First, it collects and indexes publicly available facial images from the web. Second, it processes user-uploaded photos to find matches. Under CCPA, California residents have the right to know whether a face search engine has collected their facial data and to request its deletion. They can also opt out of having their facial data sold or shared for cross-context behavioral advertising. However, CCPA includes exceptions for publicly available information — and since most facial data used by face search engines comes from public web sources, there is a complex legal gray area.
How facesearching Complies with CCPA
facesearching is committed to privacy compliance. We provide California residents with a clear mechanism to request access to any facial data we may hold about them, to request deletion of that data, and to opt out of data sharing. We do not sell facial data to third parties. We process facial data only for the purpose of providing reverse face search results, and we delete user-uploaded photos after the search is complete. Our privacy policy is transparent about what data we collect, how we use it, and how users can exercise their CCPA rights.
Your Rights as a California Face Search User
If you are a California resident, you have the right to submit a verified request to any face search engine asking what facial data they hold about you. You can request deletion of that data. You can opt out of the sale or sharing of your data. And you cannot be discriminated against — denied service, charged higher prices, or given lower quality results — for exercising these rights. To exercise your rights with facesearching, contact our privacy team through the channels listed in our privacy policy. We respond to all verified requests within 45 days, as required by law.
Understanding CCPA is important for anyone who uses or is affected by face search technology. For a broader look at privacy in face search, see our guide to privacy rights and face search. And if you are concerned about whether your own photos are being used online, learn how to check if your photos are being used by scammers. Privacy is not just a legal requirement — it is the foundation of trust in any technology that handles personal data.